cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 98

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 7.8CVE-2023-40590EPSS 0.5%

    GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a u…

  2. 8.8CVE-2023-40195EPSS 1.9%

    Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider. When the Apache Spark provider is installed on an Airflow deployment, a…

  3. 9.8CVE-2023-40571EPSS 1.4%

    weblogic-framework is a tool for detecting weblogic vulnerabilities. Versions 0.2.3 and prior do not verify the returned data packets, and there is a deserialization vulnerability which may lead to remote code execution. When weblogic-fram…

  4. 7.8CVE-2023-24621EPSS 0.5%

    An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.

  5. 8.8CVE-2023-32079EPSS 0.9%

    Netmaker makes networks with WireGuard. A Mass assignment vulnerability was found in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user to escalate privileges to those of an admin user. The issue is patched in 0.17.1 and fixe…

  6. 7.8CVE-2023-34040EPSS 2.1%

    In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized objec…

  7. 7.8CVE-2023-38831KEVExploitEPSS 99.8%

    RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also…

  8. 7.5CVE-2023-41105EPSS 2.6%

    An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would…

  9. 9.8CVE-2023-4041EPSS 0.4%

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Out-of-bounds Write, Download of Code Without Integrity Check vulnerability in Silicon Labs Gecko Bootloader on ARM (Firmware Update File Parser modules) allows Code I…

  10. 7.2CVE-2023-40352EPSS 0.7%

    McAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLLs.

  11. 8.8CVE-2023-39106EPSS 1.3%

    An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constructor() component.

  12. 7.8CVE-2023-3078EPSS 0.2%

    An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges.

  13. 7.3CVE-2022-4894EPSS 0.2%

    Certain HP and Samsung Printer software packages may potentially be vulnerable to elevation of privilege due to Uncontrolled Search Path Element.

  14. 9.8CVE-2023-3259EPSS 1.0%

    The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier is vulnerable to authentication bypass. By manipulating the IP address field in the "iBootPduSiteAuth" cookie, a malicious agent can direct the device to connect to …

  15. 7.5CVE-2023-39396EPSS 0.5%

    Deserialization vulnerability in the input module. Successful exploitation of this vulnerability may affect availability.

  16. 7.8CVE-2023-22955EPSS 0.3%

    An issue was discovered on AudioCodes VoIP desk phones through 3.4.4.1000. The validation of firmware images only consists of simple checksum checks for different firmware components. Thus, by knowing how to calculate and where to store th…

  17. 9.8CVE-2023-40254EPSS 0.2%

    Download of Code Without Integrity Check vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Malicious Software Update.This issue affects Genian NAC V4.0: from V4.0.0…

  18. 7.3CVE-2023-34355EPSS 0.2%

    Uncontrolled search path element for some Intel(R) Server Board M10JNP2SB integrated BMC video drivers before version 3.0 for Microsoft Windows and before version 1.13.4 for linux may allow an authenticated user to potentially enable escal…

  19. 7.8CVE-2023-29151EPSS 0.2%

    Uncontrolled search path element in some Intel(R) PSR SDK before version 1.0.0.20 may allow an authenticated user to potentially enable escalation of privilege via local access.

  20. 7.3CVE-2023-28823EPSS 0.2%

    Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authenticated user to potentially enable escalation of privilege via local access.

  21. 7.8CVE-2023-28405EPSS 0.2%

    Uncontrolled search path in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2022.3.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  22. 8.8CVE-2023-28380EPSS 0.6%

    Uncontrolled search path for the Intel(R) AI Hackathon software before version 2.0.0 may allow an unauthenticated user to potentially enable escalation of privilege via network access.

  23. 7.8CVE-2023-25944EPSS 0.2%

    Uncontrolled search path element in some Intel(R) VCUST Tool software downloaded before February 3nd 2023 may allow an authenticated user to potentially enable escalation of privilege via local access.

  24. 7.8CVE-2023-25182EPSS 0.2%

    Uncontrolled search path element in the Intel(R) Unite(R) Client software for Mac before version 4.2.11 may allow an authenticated user to potentially enable escalation of privilege via local access.

  25. 7.3CVE-2023-24016EPSS 0.2%

    Uncontrolled search path element in some Intel(R) Quartus(R) Prime Pro and Standard edition software for linux may allow an authenticated user to potentially enable escalation of privilege via local access.

  26. 7.3CVE-2023-23577EPSS 0.2%

    Uncontrolled search path element for some ITE Tech consumer infrared drivers before version 5.5.2.1 for Intel(R) NUC may allow an authenticated user to potentially enable escalation of privilege via local access.

  27. 7.3CVE-2023-22841EPSS 0.2%

    Unquoted search path in the software installer for the System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(R) Server Systems Based on Intel(R) 621A Chipset before version 16.0.7 may allow an authenticated u…

  28. 7.8CVE-2022-43456EPSS 0.2%

    Uncontrolled search path in some Intel(R) RST software before versions 16.8.5.1014.5, 17.11.3.1010.2, 18.7.6.1011.2 and 19.5.2.1049.5 may allow an authenticated user to potentially enable escalation of privilege via local access.

  29. 7.8CVE-2022-25864EPSS 0.2%

    Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  30. 7.8CVE-2022-47636ExploitEPSS 1.3%

    A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory av_li…

  31. 4.7CVE-2023-29299EPSS 0.4%

    Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Untrusted Search Path vulnerability that could lead to Application denial-of-service. An attacker could leverage this vulnerability …

  32. 7.2CVE-2023-37864EPSS 0.4%

    In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote attacker with SNMPv2 write privileges may use an a special SNMP request to gain full access to the device.

  33. 5.5CVE-2023-39212EPSS 0.2%

    Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access.

  34. 7.8CVE-2023-36344EPSS 0.4%

    An issue in Diebold Nixdorf Vynamic View Console v.5.3.1 and before allows a local attacker to execute arbitrary code via not restricting the search path for required DLLs and not verifying the signature.

  35. 8.0CVE-2023-38182EPSS 5.9%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  36. 8.8CVE-2023-38181EPSS 11%

    Microsoft Exchange Server Spoofing Vulnerability

  37. 7.8CVE-2023-36898EPSS 0.7%

    Tablet Windows User Interface Application Core Remote Code Execution Vulnerability

  38. 8.8CVE-2023-36541EPSS 0.5%

    Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via network access.

  39. 7.8CVE-2023-36540EPSS 0.3%

    Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.

  40. 8.0CVE-2023-35388EPSS 6.8%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  41. 7.8CVE-2021-41544EPSS 0.2%

    A vulnerability has been identified in Siemens Software Center (All versions < V3.0). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the directories …

  42. 9.0CVE-2023-37490EPSS 0.3%

    SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary directory during the installation process. On replacing this executable with a m…

  43. 5.7CVE-2023-4177EPSS 0.2%

    A vulnerability was found in EmpowerID up to 7.205.0.0. It has been rated as problematic. This issue affects some unknown processing of the component Multi-Factor Authentication Code Handler. The manipulation leads to information disclosur…

  44. 9.8CVE-2023-38689EPSS 1.5%

    Logistics Pipes is a modification (a.k.a. mod) for the computer game Minecraft Java Edition. The mod used Java's `ObjectInputStream#readObject` on untrusted data coming from clients or servers over the network resulting in possible remote …

  45. 9.8CVE-2023-36480EPSS 1.8%

    The Aerospike Java client is a Java application that implements a network protocol to communicate with an Aerospike server. Prior to versions 7.0.0, 6.2.0, 5.2.0, and 4.5.0 some of the messages received from the server contain Java objects…

  46. 9.8CVE-2023-36139EPSS 0.5%

    In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.

  47. 9.8CVE-2023-36134EPSS 0.6%

    In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote attackers to take over accounts.

  48. 5.5CVE-2023-3749EPSS 0.1%

    A local user could edit the VideoEdge configuration file and interfere with VideoEdge operation.

  49. 7.3CVE-2023-3662EPSS 0.2%

    In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users context .

  50. 5.5CVE-2023-36858EPSS 0.1%

    An insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may allow an attacker to modify its configured server list.  Note: Software versions which have reached End of Technical Support (Eo…